Security, sender ID, and SLA

API keys

Keys are Bearer tokens with the prefix robe_ followed by 64 hex characters. There is no rb_test_*, rb_live_*, or sk_live_* scheme. Keys are stored as SHA-256 hashes; the full secret is shown once at creation and can be revoked from the dashboard.

Sender IDs

Recipients see an alphanumeric sender ID when the upstream carrier accepts one. Registration is done with those carriers by our operators on your behalf. There is no public POST /v1/sender-ids endpoint. Transactional OTP traffic is routed on transactional paths so Nigeria’s NCC DND registry is not treated as a promo filter for one-time passcodes.

Delivery and SLA

Prepaid routes for Nigeria, Ghana, Kenya, South Africa, the United Kingdom, the United States, Benin, and Ivory Coast. Other destinations on request. If the primary provider for a country fails, the send is retried on the configured fallback. Credits are refunded when every provider fails, or when anti-spam blocks the message before it reaches a carrier. We do not publish a delivery-rate percentage.

No public delivery-rate percentage is published. Credits are refunded when every upstream provider fails or anti-spam blocks a send. Terms of service: we strive for high availability and do not guarantee 100% uptime. SMS delivery still depends on downstream networks.

Webhooks

Deliveries are signed with X-Robase-Signature — hex HMAC-SHA256 of the raw body. Verify against the bytes you received, not a re-encoded JSON object. The signing secret is shown and rotatable in the dashboard.

What this API is not

• Public transactional email API (account mail uses Resend/SMTP internally)
• Python SDK / PyPI package named robase
• Test-mode keys (rb_test_*, sk_live_*)
• Uganda, Tanzania, or Egypt as priced routes

Report a vulnerability

Mail support@robase.dev with the details and give us a chance to fix it before publishing. Never send live API keys or full OTP codes.